dsh-notion-oauth-ui: Connect to Notion via OAuth 2.0 + PKCE

Introduction¶

In the DeepSeek Harness (DSH) ecosystem, connecting to external services typically requires command-line operations or manually handling authentication tokens. The dsh-notion-oauth-ui plugin provides a GUI-based solution, leveraging the OAuth 2.0 and PKCE protocols to enable seamless sign-in through the official Notion MCP server.

Plugin Positioning¶

This is a GUI plugin for connecting to Notion. It allows users to complete OAuth 2.0 authorization directly through a browser in the DSH interface, without manually copying an Integration Token or maintaining credentials in a terminal. Pages, databases, and comments are accessed through the official Notion MCP server.

Core Features¶

1. GUI Login: Click the “Login” button on the DSH settings page to complete authentication, without terminal interaction.
2. OAuth 2.0 + PKCE: Uses dynamic client registration (RFC 7591) and PKCE (S256); no client_id/secret configuration is required.
3. Silent Refresh: Access tokens are refreshed automatically before expiration, and refresh tokens support atomic rotation.
4. Standard Tools: Provides the mcp__notion__* family of tools through the official MCP server for searching, reading, and writing pages and databases.
5. CLI Fallback: Supports the dsh notion login command in no-GUI environments or pure CLI profiles.

Installation and Configuration¶

Installing this plugin requires DSH’s package manager.

dsh plugin --profile <name> add dsh-notion-oauth-ui

After installation, configure the relevant parameters in Settings. Defaults are as follows:

Usage¶

GUI Flow¶

1. Open DSH, go to Plugins in the sidebar, and click Add plugin.
2. Enter dsh-notion-oauth-ui and click Install.
3. Open Settings (gear icon or Ctrl + ,), and find Notion in the plugin list.
4. Click the Login button, and the browser will open Notion’s authorization page.
5. Select the workspace and check “I recognize and trust this URL”, then click Continue.
6. After successful authorization, the page shows Connected, and the mcp__notion__* tools become available.

CLI Flow¶

For no-GUI or pure CLI profiles, the workflow is the same; only run the following in the terminal:

dsh plugin --profile <name> add dsh-notion-oauth-ui
dsh notion login

Security and Architecture¶

The plugin is designed with security in mind:

• Loopback-only control routing: The configuration-page API routes (/api/dsh-notion-oauth-ui/{status,login,logout}) accept requests only from 127.0.0.1, and strictly validate the HTTP method and Host header to prevent cross-site request forgery.
• OAuth hardening: Uses the authorization code flow plus PKCE (S256); each authorization flow carries a unique state parameter, and a 10-minute callback deadline is set to prevent malicious callbacks from interrupting a real authorization.
• Transport security: mcpUrl must use the https:// protocol to prevent man-in-the-middle attacks.
• Token at-rest storage: Access tokens and refresh tokens are stored in DSH’s credential service (record name is NOTION_OAUTH). These tokens are visible only inside the DSH process and are not exposed to the browser or written to logs.

Use Cases¶

This plugin is suitable for developers or users who frequently work with Notion data, especially in scenarios that favor GUI operations over command-line input.

Note: DSH plugins run with the same user permissions as the main process. The plugin stores sensitive information through DSH’s credential service, and any plugin with credential access can read it (including NOTION_OAUTH and DEEPSEEK_API_KEY). Please ensure your system environment is secure.

Conclusion¶

dsh-notion-oauth-ui simplifies the integration workflow between Notion and DSH through the official MCP standard and the OAuth 2.0 protocol. It automates cumbersome token management while ensuring security through strict local routing and HTTPS restrictions.

• GitHub repository
• Plugin directory